cve-2024-35981
Vulnerability from cvelistv5
Published
2024-05-20 09:42
Modified
2024-08-02 03:21
Severity
Summary
virtio_net: Do not send RSS key if it is not supported
References
SourceURLTags
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/059a49aa2e25c58f90b50151f109dd3c4cdb3a47
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/28e9a64638cd16bc1ecac9ff74ffeacb9fb652de
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/43a71c1b4b3a6d4db857b1435d271540279fc7de
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/539a2b995a4ed93125cb0efae0f793b00ab2158b
Impacted products
VendorProduct
LinuxLinux
LinuxLinux
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-35981",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-20T14:22:46.032689Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:34:34.669Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:21:49.058Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/539a2b995a4ed93125cb0efae0f793b00ab2158b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/43a71c1b4b3a6d4db857b1435d271540279fc7de"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/28e9a64638cd16bc1ecac9ff74ffeacb9fb652de"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/059a49aa2e25c58f90b50151f109dd3c4cdb3a47"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/virtio_net.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "539a2b995a4e",
              "status": "affected",
              "version": "c7114b1249fa",
              "versionType": "git"
            },
            {
              "lessThan": "43a71c1b4b3a",
              "status": "affected",
              "version": "c7114b1249fa",
              "versionType": "git"
            },
            {
              "lessThan": "28e9a64638cd",
              "status": "affected",
              "version": "c7114b1249fa",
              "versionType": "git"
            },
            {
              "lessThan": "059a49aa2e25",
              "status": "affected",
              "version": "c7114b1249fa",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/virtio_net.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.90",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.29",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.7",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio_net: Do not send RSS key if it is not supported\n\nThere is a bug when setting the RSS options in virtio_net that can break\nthe whole machine, getting the kernel into an infinite loop.\n\nRunning the following command in any QEMU virtual machine with virtionet\nwill reproduce this problem:\n\n    # ethtool -X eth0  hfunc toeplitz\n\nThis is how the problem happens:\n\n1) ethtool_set_rxfh() calls virtnet_set_rxfh()\n\n2) virtnet_set_rxfh() calls virtnet_commit_rss_command()\n\n3) virtnet_commit_rss_command() populates 4 entries for the rss\nscatter-gather\n\n4) Since the command above does not have a key, then the last\nscatter-gatter entry will be zeroed, since rss_key_size == 0.\nsg_buf_size = vi-\u003erss_key_size;\n\n5) This buffer is passed to qemu, but qemu is not happy with a buffer\nwith zero length, and do the following in virtqueue_map_desc() (QEMU\nfunction):\n\n  if (!sz) {\n      virtio_error(vdev, \"virtio: zero sized buffers are not allowed\");\n\n6) virtio_error() (also QEMU function) set the device as broken\n\n    vdev-\u003ebroken = true;\n\n7) Qemu bails out, and do not repond this crazy kernel.\n\n8) The kernel is waiting for the response to come back (function\nvirtnet_send_command())\n\n9) The kernel is waiting doing the following :\n\n      while (!virtqueue_get_buf(vi-\u003ecvq, \u0026tmp) \u0026\u0026\n\t     !virtqueue_is_broken(vi-\u003ecvq))\n\t      cpu_relax();\n\n10) None of the following functions above is true, thus, the kernel\nloops here forever. Keeping in mind that virtqueue_is_broken() does\nnot look at the qemu `vdev-\u003ebroken`, so, it never realizes that the\nvitio is broken at QEMU side.\n\nFix it by not sending RSS commands if the feature is not available in\nthe device."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-29T05:32:22.847Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/539a2b995a4ed93125cb0efae0f793b00ab2158b"
        },
        {
          "url": "https://git.kernel.org/stable/c/43a71c1b4b3a6d4db857b1435d271540279fc7de"
        },
        {
          "url": "https://git.kernel.org/stable/c/28e9a64638cd16bc1ecac9ff74ffeacb9fb652de"
        },
        {
          "url": "https://git.kernel.org/stable/c/059a49aa2e25c58f90b50151f109dd3c4cdb3a47"
        }
      ],
      "title": "virtio_net: Do not send RSS key if it is not supported",
      "x_generator": {
        "engine": "bippy-a5840b7849dd"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-35981",
    "datePublished": "2024-05-20T09:42:05.722Z",
    "dateReserved": "2024-05-17T13:50:33.144Z",
    "dateUpdated": "2024-08-02T03:21:49.058Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-35981\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-20T10:15:12.617\",\"lastModified\":\"2024-05-20T13:00:04.957\",\"vulnStatus\":\"Awaiting Analysis\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nvirtio_net: Do not send RSS key if it is not supported\\n\\nThere is a bug when setting the RSS options in virtio_net that can break\\nthe whole machine, getting the kernel into an infinite loop.\\n\\nRunning the following command in any QEMU virtual machine with virtionet\\nwill reproduce this problem:\\n\\n    # ethtool -X eth0  hfunc toeplitz\\n\\nThis is how the problem happens:\\n\\n1) ethtool_set_rxfh() calls virtnet_set_rxfh()\\n\\n2) virtnet_set_rxfh() calls virtnet_commit_rss_command()\\n\\n3) virtnet_commit_rss_command() populates 4 entries for the rss\\nscatter-gather\\n\\n4) Since the command above does not have a key, then the last\\nscatter-gatter entry will be zeroed, since rss_key_size == 0.\\nsg_buf_size = vi-\u003erss_key_size;\\n\\n5) This buffer is passed to qemu, but qemu is not happy with a buffer\\nwith zero length, and do the following in virtqueue_map_desc() (QEMU\\nfunction):\\n\\n  if (!sz) {\\n      virtio_error(vdev, \\\"virtio: zero sized buffers are not allowed\\\");\\n\\n6) virtio_error() (also QEMU function) set the device as broken\\n\\n    vdev-\u003ebroken = true;\\n\\n7) Qemu bails out, and do not repond this crazy kernel.\\n\\n8) The kernel is waiting for the response to come back (function\\nvirtnet_send_command())\\n\\n9) The kernel is waiting doing the following :\\n\\n      while (!virtqueue_get_buf(vi-\u003ecvq, \u0026tmp) \u0026\u0026\\n\\t     !virtqueue_is_broken(vi-\u003ecvq))\\n\\t      cpu_relax();\\n\\n10) None of the following functions above is true, thus, the kernel\\nloops here forever. Keeping in mind that virtqueue_is_broken() does\\nnot look at the qemu `vdev-\u003ebroken`, so, it never realizes that the\\nvitio is broken at QEMU side.\\n\\nFix it by not sending RSS commands if the feature is not available in\\nthe device.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: virtio_net: no enviar clave RSS si no es compatible. Hay un error al configurar las opciones de RSS en virtio_net que puede da\u00f1ar toda la m\u00e1quina, haciendo que el kernel entre en un bucle infinito. Ejecutar el siguiente comando en cualquier m\u00e1quina virtual QEMU con virtionet reproducir\u00e1 este problema: # ethtool -X eth0 hfunc toeplitz As\u00ed es como ocurre el problema: 1) ethtool_set_rxfh() llama a virtnet_set_rxfh() 2) virtnet_set_rxfh() llama a virtnet_commit_rss_command() 3) virtnet_commit_rss_command() completa 4 entradas para rss scatter-gather 4) Dado que el comando anterior no tiene una clave, la \u00faltima entrada de scatter-gatter se pondr\u00e1 a cero, ya que rss_key_size == 0. sg_buf_size = vi-\u0026gt;rss_key_size; 5) Este b\u00fafer se pasa a qemu, pero qemu no est\u00e1 contento con un b\u00fafer con longitud cero, y haga lo siguiente en virtqueue_map_desc() (funci\u00f3n QEMU): if (!sz) { virtio_error(vdev, \\\"virtio: buffers de tama\u00f1o cero no est\u00e1n permitidos\\\"); 6) virtio_error() (tambi\u00e9n funci\u00f3n QEMU) configura el dispositivo como roto vdev-\u0026gt;broken = true; 7) Qemu se retira y no responde a este kernel loco. 8) El kernel est\u00e1 esperando a que regrese la respuesta (funci\u00f3n virtnet_send_command()) 9) El kernel est\u00e1 esperando haciendo lo siguiente: while (!virtqueue_get_buf(vi-\u0026gt;cvq, \u0026amp;tmp) \u0026amp;\u0026amp; !virtqueue_is_broken(vi-\u0026gt;cvq)) cpu_relax(); 10) Ninguna de las siguientes funciones anteriores es verdadera, por lo tanto, el n\u00facleo se repite aqu\u00ed para siempre. Teniendo en cuenta que virtqueue_is_broken() no mira el qemu `vdev-\u0026gt;broken`, por lo tanto, nunca se da cuenta de que el vitio est\u00e1 roto en el lado de QEMU. Solucionelo no enviando comandos RSS si la funci\u00f3n no est\u00e1 disponible en el dispositivo.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/059a49aa2e25c58f90b50151f109dd3c4cdb3a47\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/28e9a64638cd16bc1ecac9ff74ffeacb9fb652de\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/43a71c1b4b3a6d4db857b1435d271540279fc7de\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/539a2b995a4ed93125cb0efae0f793b00ab2158b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.